Automated reasoning over string constraints

Abstract

More and more applications in verification and security rely on automatic solvers, which can check the satisfiability of constraints over a rich set of data types, including character strings. Unfortunately, most string solvers today are standalone tools that can reason only about some fragment of the theory of strings and regular expressions, sometimes with strong restrictions on the expressiveness of their input language (such as, length bounds on all string variables). These specialized solvers reduce string problems to satisfiability problems over specific data types, such as bit vectors, or to automata decision problems. On the other hand, despite their power and success as back-end reasoning engines, general-purpose Satisfiability Modulo Theories (SMT) solvers so far have provided minimal or no native support for string reasoning. This thesis presents a deductive calculus describing a new algebraic approach that allows solving constraints over the theory of unbounded strings and regular expressions natively, without reduction to other problems. We provide proofs of refutation soundness and solution soundness of our calculus, and solution completeness under a fair proof strategy. Moreover, we show that our calculus is a decision procedure for solving regular membership and length constraints. We have implemented our calculus as a string solver for the theory of unbounded strings with concatenation, length, and membership in regular languages, and incorporated it into the SMT solver cvc4 to expand its already large set of built-